CVE-2026-46344: liboqs XMSS Out-of-Bounds Read in Signature Verification

Technical summary

The vulnerability exists in the xmss_sign_open and xmssmt_sign_open functions. These functions receive a signature buffer sized according to the caller's declared algorithm. However, the functions re-extract the OID (object identifier) from the public key bytes pk[0..3] and use that OID to look up a potentially different sig_bytes value. If the OID in the public key references an XMSS parameter set with larger sig_bytes than the one the caller intended, the code attempts to read beyond the supplied signature buffer. The out-of-bounds bytes are consumed only as input to internal hash computations (HASH_UPDATE operations) and are never returned, leaked, or used for control flow decisions. The impact is limited to denial of service through potential page fault exceptions when the read crosses into unmapped memory.

Business impact

Applications and services using liboqs for signature verification could experience availability disruption if an attacker provides crafted public keys that trigger out-of-bounds reads crossing page boundaries. This is particularly relevant for systems using post-quantum cryptography in production or pilots, including those integrating liboqs for hybrid classical-post-quantum signing schemes. The denial-of-service risk is real but containable: only verification operations with mismatched key metadata can trigger the condition, and the crash is deterministic based on memory layout rather than probabilistic.

Affected systems

Any deployment of liboqs prior to version 0.16.0 using XMSS or XMSS^MT signature verification is affected. This includes applications embedding liboqs directly, as well as systems that depend on projects that bundle liboqs. The OpenQuantumSafe project and its liboqs library are the direct affected vendor/product.

Exploitability

Exploitability is straightforward for attackers with the ability to influence the public key supplied to a verification function. No authentication, special privileges, or user interaction is required; the attack is network-accessible and works over the network if the verifying service processes untrusted keys. However, weaponization is limited to denial of service; there is no information disclosure or signature forgery. An attacker cannot bypass authentication or forge valid signatures.

Remediation

Upgrade liboqs to version 0.16.0 or later. This patch corrects the OID re-parsing logic to ensure that signature buffer bounds are checked against the caller's declared algorithm rather than blindly re-interpreting the public key. Organizations should verify their liboqs version in production and staging environments, then apply the update through their standard package management or build processes.

Patch guidance

Update liboqs to 0.16.0 or later. Verify the version of liboqs in your build artifacts and runtime environment using the library's version APIs or package managers. If liboqs is vendored as a dependency within another project, check that the parent project has also updated to a version that includes the fixed liboqs. Test verification operations with both correctly-matched and intentionally mismatched key-metadata pairs to confirm the patch prevents the out-of-bounds access.

Detection guidance

Monitor application and service logs for segmentation faults, access violations, or crashes occurring during signature verification operations. In containerized environments, watch for OOMKilled or SIGSEGV events. If you maintain liboqs version metadata in your software inventory, query for instances prior to 0.16.0. Code review or static analysis can identify calls to xmss_sign_open or xmssmt_sign_open with insufficient validation of public key metadata before the call.

Why prioritize this

Although the CVSS score is MEDIUM (5.3), prioritize patching based on your reliance on XMSS/XMSS^MT verification. If your organization is piloting or deploying post-quantum cryptography, this is a direct blocker. The attack surface is network-accessible and requires no authentication, but impact is limited to availability. Patch within 30 days for systems in production; expedite if XMSS/XMSS^MT verification is customer-facing or part of a critical pipeline.

Risk score, explained

The CVSS v3.1 score of 5.3 MEDIUM reflects: network accessibility (AV:N), low attack complexity (AC:L), no privilege requirement (PR:N), and no user interaction needed (UI:N). However, the impact is limited to availability (A:L) with no confidentiality or integrity compromise (C:N, I:N), yielding a moderate score. The score does not account for the specificity of triggering the condition (requires crafted public keys with mismatched OID metadata) or the containment of impact to denial of service.

Frequently asked questions